| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| System.Text.Encodings.Web | ≥ 4.0.0, < 4.5.1≥ 4.6.0, < 4.7.2≥ 5.0.0, < 5.0.1 | 4.5.14.7.25.0.1 |
| .net | ≥ 5.0, < 5.0.4 | 5.0.4 |
| .net core | ≥ 2.1, < 2.1.28≥ 3.1, < 3.1.15 | 2.1.283.1.15 |
| powershell core | = 7.0= 7.1 | |
| visual studio 2019 | ≥ 16.0, ≤ 16.9 |
.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.
Discussion for this issue can be found at dotnet/runtime#49377
Microsoft has not identified any mitigating factors for this vulnerability.
The vulnerable package is System.Text.Encodings.Web . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.
Vulnerable package versions:
Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.
| Package Name | Vulnerable Versions | Secure Versions |
|---|---|---|
| System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1 |
| System.Text.Encodings.Web | 4.6.0-4.7.1 | 4.7.2 |
| System.Text.Encodings.Web | 5.0.0 | 5.0.1 |
Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン